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ABSTRACT 

Consider a matching problem on a graph where disjoint sets 
of vertices are privately owned by self-interested agents. An 
edge between a pair of vertices indicates compatibility and 
allows the vertices to match. We seek a mechanism to maxi- 
mize the number of matches despite self-interest, with agents 
that each want to maximize the number of their own ver- 
tices that match. Each agent can choose to hide some of its 
vertices, and then privately match the hidden vertices with 
any of its own vertices that go unmatched by the mecha- 
nism. A prominent application of this model is to kidney 
exchange, where agents correspond to hospitals and vertices 
to donor-patient pairs. Here hospitals may game an ex- 
change by holding back pairs and harm social welfare. 

In this paper we seek to design mechanisms that are strat- 
egyproof, in the sense that agents cannot benefit from hiding 
vertices, and approximately maximize efficiency, i.e., pro- 
duce a matching that is close in cardinality to the maximum 
cardinality matching. Our main result is the design and 
analysis of the eponymous Mix-AND-Match mechanism; we 
show that this randomized mechanism is strategyproof and 
provides a 2- approximation. Lower bounds establish that 
the mechanism is near optimal. 

Categories and Subject Descriptors 

F.2 [Theory of Computation]: Analysis of Algorithms 
and Problem Complexity; J. 4 [Computer Applications]: 

Social and Behavioral Sciences — Economics 

General Terms 

Algorithms, Theory, Economics 
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1. INTRODUCTION 

Treatment for many types of kidney disease relies on 
transplantation of a kidney. Since humans have two kid- 
neys and only need one to survive, many patients have a 
family member or friend willing to donate them a kidney. 
However, for various reasons, not all potential donors are 
compatible with their desired recipient. A recent innova- 
tion is the idea of a kidney exchange, where incompatible 
donor-patient pairs u and v such that the donor of pair u is 
compatible with the patient of pair v and the donor of pair v 
is compatible with the patient of pair u can effectively trade 
kidneys. 

Kidney exchanges have attracted researchers from eco- 
nomics (see, e.g., i9, 2i, 20, 23 ) and computer science (see, 
e.g., mH]). Much of this research considers the incentives 
of the donor-patient pairs participating in exchanges. How- 
ever, as centralized kidney exchanges are growing, another 
important decision maker becomes involved: hospitals. Hos- 
pitals act as agents to find matches for their patients. To 
do so they may join a group of hospitals that pool their pa- 
tients and try to find as many matches as possible. This 
introduces strategic issues for the hospitals: they may be 
able to match more of their patients if they selectively omit 
some of them from the pool and instead match them with 
other local patients. While this may be better for the hospi- 
tal's patients, it is worse for other patients that might have 
been matched with them. 

In this paper we examine an abstract model of exchanges 
where each agent acts on behalf of a set of clients to find ex- 
changes. In addition to kidney exchanges this model applies 
to other settings such as house exchanges (where the agents 
are real estate agents and the clients are house owners). 

Consider a set of agents, each of whom has a set of clients 
who seek to exchange objects with each other. In this paper 
we assume that each exchange involves two clients and each 
client can participate in at most one exchange. We assume 
that each agent only cares about its own clients and therefore 
seeks to maximize the number of its clients that participate 
in an exchange Q 

A centralized mechanism to which agents report their 
clients' information can enable exchanges between clients of 
different agents. This yields more exchanges and increases 



^Exchanges in our model are abstract and it is irrelevant 
to our results whether or not monetary transfers between 
clients are involved, as long as the terms of the exchange are 
always the same. 



social welfare compared to a situation in which each agent 
operates on its own. In other words, we would like agents to 
share their individual databases of clients and apply a cen- 
tralized matching algorithm to the resulting global database. 

More formally, the possible exchanges among a set of 
clients can be represented as an undirected graph in which 
the vertices represent clients and an undirected edge between 
clients u and v means that u and v can exchange their ob- 
jects. A matching of the graph then corresponds to a set of 
two-way exchanges. We assume that the set of clients of 
each agent is private information of that agent, while for 
any pair of clients it is verifiable by anyone whether an ex- 
change can be conducted between them. Each agent wishes 
to maximize the number of its own clients that are matched. 

A mechanism receives the graph induced by the agents' 
reported subsets of clients, and outputs a matching of that 
graph. However, since agents need not report all their 
clients, a second stage takes place in which each agent finds a 
matching in the graph induced by the set of its clients that 
have not been matched in the first stage, which includes 
those clients not reported by the agent, and those reported 
but not matched by the mechanism. The utility of the agent 
then equals the number of its clients that were matched in 
one of the two stages. 

The above model was first studied by Roth et al. [22] and 
Ashlagi et al. [4] in order to deal with incentives of the hos- 
pitals. Roth et al. [22] observed that there are no efficient 
and strategyproof (SP) mechanisms, where strategyproof- 
ness means that it is a dominant strategy for each agent 
to report all of its clients. Ashlagi et al. then proceeded 
to study efficient mechanisms in the Bayesian setting (see 
Section [5] for more details). 

In this paper we take a fundamentally different, prior- 
free approach to the nonexistence of efficient and SP mech- 
anisms, by relaxing efficiency rather than strategyproofness. 
More specifically, we study the strength of SP mechanisms in 
terms of the fraction of social welfare they recover. We say 
that a mechanism is an a- approximation mechanism if the 
cardinality of the maximum cardinality matching is always 
at most a times the cardinality of the matching returned 
by the mechanism[3 Our goal is to design mechanisms that 
are SP and at the same time provide a good approximation 
ratio. 

Since in most countries it is both illegal and considered 
immoral to make payments in return for organs, we are in- 
terested in mechanisms without payments. This goal is com- 
patible with the agenda of approximate mechanism design 
without money 18i. 

Our results. In Section[4]we establish some lower bounds. 
Our starting point is an example, due to Roth et al. [5^ 
(see also Ashlagi et al. [4|), which implies that a mecha- 
nism that always returns an optimal matching cannot be 
strategyproof. We refine their result by observing that no 
deterministic SP mechanism can provide an approximation 
ratio better than two, and no randomized SP mechanism 
can provide an approximation ratio better than 4/3 (Theo- 
rem lUl)- 



^ Since the cardinality of a matching is exactly twice its social 
welfare, approximating the cardinality of the maximum car- 
dinality matching is equivalent to approximating the maxi- 
mum social welfare. 



In Section[5]we introduce a mechanism, termed MATCHn, 
that is parameterized by a bipartition 11 = (IIi,Il2) of the 
agents. Roughly speaking, given a graph the mechanism 
returns a matching that has maximum cardinality among all 
the matchings that (i) contain no edges between the vertex 
sets of two agents on the same side of the bipartition, and 
(ii) are a maximum cardinality matching when restricted to 
the vertex set of each individual agent. Our main technical 
result is the following theorem. 

Theorem 15.11 For any number of agents, and for any 
bipartition 11 of the set of agents, MATCHn is SP. 

The main idea behind the proof of this theorem rather 
subtle. It relies on the fact that if one takes the union of the 
two matchings produced by the mechanism before and after 
an agent hides some of its vertices, then this union cannot 
contains a cycle that visits the vertex sets of an odd number 
of agents. This property holds because the mechanism does 
not match edges between vertex sets of agents on the same 
side of the bipartition. 

We further show that MATCHn can be executed in polyno- 
mial time. Unfortunately, for any deterministically fixed bi- 
partition n, MATCHn does not generally provide a bounded 
approximation ratio. We however observe that Matchh 
yields a 2-approximation in the two agent case when used 
with the obvious bipartition that places the two agents on 
opposite sides (Corollary I5.3|l . This mechanism is in fact 
the optimal deterministic SP mechanism when there are two 
agents, since the deterministic lower bound of 2 holds even 
in this case. 

In Section [6] we consider randomized mechanisms, and 
leverage Theorem 15.11 to establish a strong randomized up- 
per bound. We introduce a mechanism, termed Mix-AND- 
Match, which consists of two steps: the mechanism first 
mixes the agents by choosing a random bipartition 11 , then 
matches the vertices by applying Matchh. The following 
theorem is conceptually the main result of the paper. 

Theorem 16.11 For any number of agents, Mix-and- 
Match is SP and provides a 2 -approximation with respect 
to social welfare. 

Strategyproofness of the mechanism follows from Theo- 
rem 15.11 in a straightforward way, but its approximation 
guarantees are nontrivial. 

Open problems and future work. There are several gaps 
between our upper and lower bounds. The most enigmatic 
gap concerns deterministic mechanisms when the number 
of agents is at least three. While Theorem 14.11 provides a 
deterministic lower bound of 2, we were unable to design a 
deterministic SP mechanism with a constant approximation 
ratio, and indeed we conjecture that such a mechanism does 
not exist (Conjecture 15. 4|) . 

With respect to randomized mechanisms, there is a small 
gap between the lower bound of 4/3 and the upper bound 
of 2 provided by Mix-AND-Match. In Section[ni we present 
a mechanism, termed Flip-AND-Match, for the case of two 
agents, which clearly provides a (4/3)-approximation. We 
conjecture that this mechanism is also SP f Conjecture 16. 2p . 
and discuss this conjecture in Appendix [X] Our unfounded 
guess is that the randomized lower bound for more than two 
agents is 2. 

There also exist a number of possible extensions to our 
work, of which we briefly point out a few. As we assume that 



agents wish to maximize the number of their clients being 
matched, a natural and realistic extension would be to in- 
corporate weights into the model. For example, a client may 
value two feasible exchanges differently, or some clients may 
be more important than others. Another direction would 
be to allow exchanges of length greater than two; in this 
case one should consider directed graphs and look for sets of 
disjoint cycles that cover many vertices. Finally, we could 
ask for the stronger requirement of group-strategyproofness, 
which requires that no group of agents would want to de- 
viate in a coordinated fashion. A related approach would 
be to consider solution concepts like the core, which ensure 
that a group of hospitals would not want to leave and form 
a smaller pool. In the case of kidney exchanges this however 
seems rather unlikely (at least in our simple model), because 
hospitals would presumably not want to leave a pool to help 
a few patients in the current match at the cost of not having 
access to the pool for all their future patients. 

2. RELATED WORK 

Work on incentives in kidney exchange. The incentives 
of incompatible donor-patients pairs have been studied for 
quite some time [191 I21| . However, as centralized kidney 
exchange clearinghouses grow, hospitals' incentives become 
a real issue. For example, reports from the Alliance for 
Paired Donation indicate that hospitals do not commit to 
assigned exchanges and perform internal exchanges instead. 

To this end, Roth et al. [22] introduced a model of kidney 
exchanges in which hospitals are agents. They show that no 
individually rational (IR) and efficient mechanism can be 
SP, where individual rationality requires that a mechanism 
matches for each agent at least the number of clients that 
it can match on its own with respect to its reported set of 
clients. In our model individual rationality is a special case 
of strategyproofness. Ashlagi et al. [4] demonstrate that 
there exists an e-Bayesian incentive compatible IR mecha- 
nism that is also efficient. Furthermore, they show that ex- 
changes of size at most four are sufficient to reach efficiency 
for large enough graphs. The priors in their Bayesian setting 
stem from data-driven parameters like the structure and fre- 
quency of blood types; no such information is required in our 
prior-free setting. 

Work on approximate mechanism design without 
money. Procaccia and Tennenholtz 18 recently introduced 
the notion of approximate mechanism design without money, 
which was already implicit in earlier work on truthful learn- 
ing [3. The starting point is the large body of work on algo- 
rithmic mechanism design, the study of truthful approxima- 
tion mechanisms for game-theoretic versions of optimization 
problems (see, e.g., [171 1131 [T2l [6l [8]). The mechanisms in 
this area typically allow the use of monetary payments to 
align agents' incentives. Procaccia and Tennenholtz argue 
that the use of money is infeasible in many settings due to 
ethical, legal, or practical considerations. In such cases it 
is more desirable to design SP mechanisms that are only 
approximately efficient but do not utilize payments. This 
approach is particularly interesting in the context of com- 
putationally tractable optimization problems: while there 
is no need to resort to approximate solutions for computa- 
tional reasons, they might be used to achieve strategyproof- 
ness when the optimal solution is not SP. 



Procaccia and Tennenholtz [18] specifically study a facil- 
ity location problem on the real line. Some of their results 
were recently improved by Lu et al. [14| . and extended to 
graphs by Alon et al. [21. Other domains to which the above 
principle was recently applied include the selection of ver- 
tices in a directed graph [3] , the allocation of items [TT] , and 
classification [15II16| . 

Most recently, Dughmi and Ghosh [9] studied approxi- 
mate mechanism design without money in the context of 
the generalized assignment problem. Their setting consists 
of a bipartite graph with jobs on one side and machines on 
the other, where machines have capacities and edges have 
values and sizes. The agents in their setting are the jobs 
(which in our setting would be the clients rather than the 
agents), and edges incident to a job are private informa- 
tion of that job. Dughmi and Ghosh in fact briefiy consider 
maximum matching as a first special case of their model, but 
their motivation, setting and results are all fundamentally 
different from ours. In particular, in the context of maxi- 
mum unweighted matching their model easily admits an SP 
optimal mechanism, whereas this problem is quite intricate 
in our model and forms the topic of this entire paper. 

3. PRELIMINARIES 

Let = {1, . . . , n} be a set of agents. For each i £ N, let 
Vi be a set of private vertices of agent i. Let G — {V, E) with 
V = Uigjv ^> undirected labeled graph, that is, each 

vertex is labeled by its agent. We slightly abuse terminology 
by simply referring to such labeled graphs as "graphs." 

A matching M <Z E on G is & subset of edges such that 
each vertex is incident to at most one edge of M. For i,j £ N 
we denote 

M,j = {{u,v) £ M : u£Vi A v £ Vj}. 

Given i £ N, we refer to edges in Mu as internal edges and 
to edges in Mij, where j £ N \ {i}, as external edges. 

Given a graph G and a matching M on G, the utility of 
agent i for this matching is 

u^{M) = \{u £V,: 3v£ Vs.t. {u,v) £ M}\, 

that is, it is equal to the number of vertices of Vi that are 
matched under M. 

We now turn to the definition of a mechanism, without 
being too formal. For a fixed number n of agents, a deter- 
ministic mechanism is a function that maps any (labeled) 
graph for n agents to a matchings of this graph. A ran- 
domized mechanism maps any graph to a probability dis- 
tribution over matchings, that is, it can select a matching 
randomly. For conciseness, we treat deterministic mecha- 
nisms as a special case of randomized mechanisms in the 
rest of this section. 

For a randomized mechanism / and a (possibly random) 
graph G, define 

u,(/(G))=Em^/(G)[w>(M)], 

where the expectation is taken over the distribution on 
matchings returned by the mechanism. In other words, the 
utility of an agent simply equals the expected number of its 
vertices being matched. 

We are concerned with situations where an agent "hides" 
a subset of its vertices and then internally matches them 
among themselves or with vertices not matched by the mech- 
anism. To make this formal we need some notation. We 



(a) Graph G. Vertices of Vi are shown in white, 
vertices of V2 in gray. 
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(b) Graph G' obtained from G when agent 1 
hides the vertices and vq. The hidden ver- 
tices are not part of the graph, but are shown to 
give the complete picture. 



(c) Graph G" obtained from G when agent 2 
hides vertices V2 and U3. 



Figure 1: Construction used in the proof of Theorem 14.11 



however feel that the idea is rather intuitive, and will avoid 
the rather cumbersome formalism in the rest of the paper. 
For any subset V' C V, let G[V'] be the subgraph of G 
induced by V' . For a graph G, an agent i £ N, and a 
matching M, let Xi{M) be the set of vertices in Vi that are 
not matched in M; if M is chosen randomly, then Xi{M) 
is a random variable. Furthermore, let /* be a mechanism 
that maps each graph G to a maximum cardinality match- 
ing of G. We say that a mechanism / is strategyproof (SP) 
if for every graph G — {V, E) with V — Uigjv ^'^^ every 
i £ N, and for every V/ C Vi it holds that 

u,mG))>n,{f{G[v\v:])) 

+ n,(r(G[K'uX,(/(G[V\\//]))])). 

In other words, a mechanism is SP if an agent can never 
benefit by hiding some of his vertices. The agent's utility 
after hiding a subset 1// of its vertices equals the (expected) 
number of its vertices that the mechanism matches given 
the subgraph induced by all vertices but those in 1//, plus 
the (expected) number of vertices in a maximum cardinality 
matching of the subgraph induced by V/ and the vertices 
not matched by the mechanism. In our model, individual 
rationality (IR) requires that an agent cannot benefit from 
the special case when V/ = Vi, and is therefore implied by 
strategyproofness. 

We are interested in mechanisms that, while being SP, 
produce matchings that maximize social welfare, i.e., the 
sum of agent utilities. For any matching M, J^jgjv Ui{M) = 
2|M|, so what we are looking for are matchings that are as 
large as possible. We say that a randomized mechanism / 
provides an a-approximation if for every graph G, 



maximum cardinality matching in which all of that agent's 
vertices are matched (Figures 1(b) and 1(c) I. Thus, one of 



ir(G)i 

E[|/(G)| 



< a. 



(1) 



where once again /* (G) is a maximum cardinality matching 
of G. For deterministic mechanisms, the expectation in ([1} 
can simply be dropped. 

4. LOWER BOUNDS 

It may not be immediately apparent that the optimal 
mechanism is not SP. Given a graph, the optimal mecha- 
nism simply returns a maximum cardinality matching (while 
employing a consistent tie-breaking rule to decide between 
different maximum cardinality matchings). 

To see how this can fail to be SP, consider the graph G 
in Figure 1(a) This graph has an odd number of vertices. 



the agents must have an unmatched vertex in G, and this 
agent can hide two of his vertices to increase his utility. This 
simple example, which is due to Roth et al. ^2], can be used 
to derive lower bounds that will later turn out to be, at least 
in one case, tight. 

Theorem 4.1. // there are at least two agents, 

1. no deterministic SP mechanism can provide an a-ap- 
proximation with respect to social welfare for a < 2, 
and 

2. no randomized SP mechanism can provide an a-ap- 
proximation with respect to social welfare for a < 4/3. 

Proof. For the first part of the theorem, we consider the 
case where A'^ — {1,2}; the proof can easily be extended 
to the case where n > 2 by adding agents with vertices 
that are not incident to any edges. Let / be a deterministic 



so every matching leaves some vertex unmatched. However, 
each agent has a pair of vertices such that removing these 
vertices from the graph results in a graph with a unique 



mechanism, and consider the graph G given in Figure 1(a) 
Since G has an odd number of vertices, it does not have 
a perfect matching, so /(G) must leave some v £ Vi or 
some w G V2 unmatched. Thus, either ui(/(G)) < 3 or 
MfiG)) < 2. 

We first deal with the case where ui{f{G)) < 3. Consider 
the graph G' that is obtained when agent 1 hides vertices W5 
and We (see Figure 1(b) I. The unique majcimum cardinality 
matching of this graph is {{vi,V2), {v3,Vi)}, a matching of 
cardinality 2. However, agent 1 could internally match the 
pair {v5,ve) and obtain a utility of 4, contradicting strate- 
gyproofness. Therefore, f(G') must have cardinality at most 
1, meaning that its approximation ratio on G' cannot be 
smaller than 2. 

The case where U2(/(G)) < 2 can be handled similarly. 
Consider the graph G" obtained when agent 2 hides vertices 
«2 and V'j, (see Figure l(c)[ ). Once again there is a unique 
maximum matching of cardinality 2, but / cannot return 
this matching since it would yield a utility of 3 to agent 2, 
in contradiction to strategyproofness. As before the mecha- 
nism is forced to select a matching of cardinality at most 1. 

The second part of the theorem can be derived using the 
same construction. Let / be a randomized SP mechanism. 
Since G does not have a perfect matching, it must be the 
case that /(G) either does not match some vertex of Vi 
with probability at least 1/2, or it does not match some 
vertex of V2 with probability at least 1/2, that is, either 
Mi(/(G)) < 7/2 orn2(/(G)) < 5/2. 

We now proceed as before. If iii(/(G)) < 7/2, we consider 
the graph G'; by strategyproofness / can only match 3/2 
pairs in expectation, but the optimum is 2. If 112 (/(G)) < 



(a) The original graph G, where the vertices of Vi are (b) The graph G', agent 2 hides vertices vs and va. 

white, the vertices of V2 are gray, and the vertices of V3 
are black. 



Figure 2: The naive 3-agent mechanism is not SP. 



5/2, we use the graph G" to show that / can only match 
3/2 pairs in expectation, while the optimum is 2. □ 

5. DETERMINISTIC MECHANISMS 

Let us now consider deterministic mechanisms. We begin 
this section by designing a deterministic mechanism that 
is SP for any number of agents, but may not provide a 
bounded approximation ratio. We then leverage this mech- 
anism to obtain an optimal deterministic SP mechanism for 
two agents. The more powerful application of our determin- 
istic mechanism will only appear in the next section, when 
we discuss randomized mechanisms. 

Let us first address the issue of designing SP determinis- 
tic mechanisms without worrying, for now, about approxi- 
mate efficiency or computational tractability. Consider the 
following mechanism for two agents. Given a graph G, the 
mechanism computes the set of all matchings on G that have 
maximum cardinality on V\ and V2, and among these selects 
a matching with maximum overall cardinality. Since every 
matching that this mechanism considers has maximum car- 
dinality on Vi and V2, it clearly is individually rational. We 
will show momentarily that it is also SP. 

But let us first consider what this mechanism does when 



«5 and vq we obtain the graph G' given in Figure 2(b) 



applied to the graph of Figure 1(a) Any matching that is a 
maximum cardinality matching on V2 would have to match 
{v2,V3), and there are two maximum cardinality matchings 
on Vi: one can either match (114, 115) or (115, ug). If we 
match (u5, v^), no additional edges can be added. Hence, the 
unique matching of cardinality 3 that maximizes the num- 
ber of internal edges is {{v2, V3), (114, 115), {v^, n?)}. The only 
unmatched vertex in this matching is vi. With the proof 
of Theorem 14.11 in mind, let us verify that agent 1 cannot 
benefit by hiding and vq. Given the graph G' in Fig- 
ure 1(b) the mechanism would simply return the matching 



(^2, «3), since this is the unique matching that is a maximum 
cardinality matching on V2. 

The two-agent mechanism suggested above seems promis- 
ing from the perspective of strategyproofness. Let us extend 
it to an n-agent mechanism in the natural way, and consider 
the mechanism that selects a matching of maximum cardi- 
nality among the matchings that have maximum cardinality 
on each Vi, i = 1, . . . ,n. In addition, let us break ties seri- 
ally: among all the matchings that meet the above criteria, 
we select a matching that maximizes the utility of agent 1; 
if there are several such matchings, we choose one that max- 
imizes the utility of agent 2, and so on. 

Interestingly enough, this n-agent mechanism is not SP, 
even when n = 3. Consider the graph G given in Fig- 
ure 2(a) Any matching that has maximum cardinal- 
ity on V2 must match (114,115) and {vq^vj); by the tie- 
breaking rule the mechanism then returns the matching 
{(w2,i'3), (w4,W5), (we.w?), (ws,«9)}- When agent 2 hides 



On this graph the mechanism returns a perfect matching 
{(«i,W2), («3,f4), {v7,vs), («9,wio)}- After internally match- 
ing (v5,U6) agent 1 gains two additional matched vertices 
compared to the matching on G. Clearly this example can 
be modified to work if ties are broken in a different order. 

The deeper reason why the above mechanism fails to be 
strategyproof is rather subtle, and has to do with the fol- 
lowing observation. If one takes the union of the matchings 
generated on the graphs of Figures [2(a)] and [2(b)| and con- 
tracts each Vi to one vertex, one obtains an odd length cycle 
between Vi, V2, and V3, as the matching on G has an edge 
between V\ and V3, and the matching on G' has edges be- 
tween V\ and V2, and V2 and V3. We proceed to refine the 
above mechanism in order to avoid such odd cycles; this 
turns out to be sufficient to guarantee strategyproofness. 
The following is in fact a family of mechanisms, parameter- 
ized by a fixed bipartition 11 = (Hi, 112) of the set of agents. 

MATCHn 

1. Given a graph G, consider all the matchings that have 
maximum cardinality on each Vi and do not have any 
edges between Vi and Vj when i, j G D; for some I £ 
{1, 2}, i.e., those that maximize the number of internal 
edges and do not have any edges between sets on the 
same side of the bipartition. 

2. Among these matchings select one of maximum cardi- 
nality, breaking ties serially in favor of agents in Hi 
and then agents in 112. 

By letting = {1, 2}, Hi = {1}, and II2 = {2}, we obtain 
the two-agent mechanism described above. The naive gen- 
eralization of this mechanism to three agents, on the other 
hand, is not an instance of MATCHn: for the example of Fig- 
ure [2] showing that the mechanism is not SP, the sets M12, 
M13, and M23 are all non-empty. We proceed to show that 
MATCHn is SP for any bipartition of the set of agents. 

Theorem 5.1. For any number of agents, and for any 
bipartition U of the set of agents, MATCHn is SP. 

Proof. Fix some bipartition 11 = (111,112) of A''. Con- 
sider a graph G, and let M — MATCHn (G). Assume that 
agent i £ N hides a subset of vertices, inducing a subgraph 
G', and let M' be the matching that results from applying 
the mechanism to G', along with the internal matching of 
agent 1 on its hidden and unmatched vertices, that is, 

M' = MATCHn(G')uM, 

where M is a maximum cardinality matching of agent i on 
its hidden and unmatched vertices. 
The symmetric difference 

MAM' = M U M' \(Mn M') 




Figure 3: Illustration of Case 1 of the proof of Theorem l5.lL with i = 1 as the manipulator, and 11 = ({1}, {2, 3}). 
MAM' is shown as a single directed path with alternating edges of M and A/'. It holds that 3 = > — 2. 

Every subpath inside V2 and V3 has even length (those from vi to vs and from vs to vio), but subpaths inside 
Vi may not have (like that from V4 and V7). The subpath of MAM' \ {Mn U Md) from Vj to V4 enters Vi but 
does not exit it, while the subpath from V13 to V14 exits Vi but does not enter it. This example satisfies ^ 
with equality. 



then consists of vertex-disjoint paths (some of which may be 
cycles) with alternating edges of M and M' . For example, 
consider the two-agent version of MATCHn applied to the 
graphs G and G' given in Figures |l(a)| and Figure |l(b)[ It 
holds that 

M = MATCHn(G') = {{V2,V3), iv4,V5), {V(,,V7)}, 

whereas, say, M' = {{v2 , V3) , {v^ , va)} . Then, MAM' is 
the single path {{v4, ws), (ws, we), (we, ^7)} where the first and 
last edge are in M and the middle edge is in M' . 

In order to simplify notation, we henceforth assume that 
MAM' consists of just one path. This assumption is made 
without loss of generality, because we show that each such 
path satisfies one of the following properties: either M 
matches at least as many vertices of Vi as Af ' for every 
i £ N, or one can derive a contradiction to the way Ai or 
M' were selected by switching between some (or all) of their 
edges on the path. Since the contradiction can be derived 
for each path separately, it follows that the first property 
holds on every path, that is, the overall utility of agent i for 
M is at least as large as its utility for M' . 

If the path in MAM' is a cycle, then this cycle must be of 
even length, because otherwise there would be a vertex that 
is incident to two edges of the same matching. It follows 
that both M and M' match all the vertices on the cycle, 
hence agent i is indifi'erent between the two matchings. We 
may therefore assume that MAM' is not a cycle. 

It will prove useful to arbitrarily fix a direction over the 
(undirected) edges of the single path in MAM' . Since the 
path is not a cycle, this direction pinpoints two specific ver- 
tices as the start and the end of the path. We further say 
that the (directed) edge (w, v) enters V, if it ^ Vj and v £Vj, 
and exits Vj ii u £ Vj and v ^Vj. 

We consider two cases. 
Case 1: \Mii\ > |Af/i|. We claim that 

E l^^^^l^ E (2) 
jsiv\{i} jeiv\{i} 

Since both M and M' axe maximum cardinality matchings 
on Vj for all j 7^ i, it must hold that every subpath of 
MAM' on Vj has even length (see Figure otherwise we 
would have, say, more edges of M than M' on the subpath, 
and by switching from M' to M on the subpath we would 
be able to increase the size of M' on Vj. This implies that 
for any j £ N \ {i}, any subpath entering Vj with an edge 
of M' must exit Vj with an edge of M, and any subpath 



entering Vj with and edge of Af must exit Vj with an edge 
of Af. 

The next part of the proof is crucial, and uses the main 
idea behind mechanism MATCHn. We argue that it also 
holds that a subpath exiting Vi with an edge of M' can 
only enter Vi with an edge of M. Assume without loss of 
generality that i G Hi. By the above argument the subpath 
enters V)i, ji G 112, with an edge of M' , and therefore exits 
it with an edge of M, entering some V,^ in Hi. If 72 7^ i, and 
the subpath exits Vj2, then it does so with an edge of M' , 
and by the same arguments returns to the vertex set of an 
agent in Hi with an edge of M. If eventually the subpath 
enters Vi again, it must be with an edge of M. Analogously, 
if the subpath exits Vi with an edge of Af, it can only enter 
Vi with an edge of Af'. See Figure [3] for an illustration. 

Now consider {MAM') \ {M^i U M^i), which again is a 
collection of vertex-disjoint subpaths. Some start and end in 
Vi , and it follows by the discussion above that such subpaths 
have exactly one edge in Mij and one edge in M^f,, for k,j£ 
N \ {i}. There can only be one subpath that starts in Vi 
but does not end in Vi, and at most one subpath that ends 
in Vi but does not start in Vi . Equation directly follows. 

We now have that 

M.(M) = 2|Afc| -f- 

jeN\{i} 

>2([A4i-fi)+j 

\jejv\{0 / 

^u^{M'), 

where the inequality follows from the fact that | Ma \ > | A//; | 
and from ((2)1. 

Case 2: \M-^\ = \M,i\. Note that it holds that \Mjj \ = \M'jj\ 
for all j G A^, that is, MAM' has to be of even length 
inside every Vj. This includes Ma and Af/j, because the 
total number of internal edges for i is even. If some subpath 
of i's internal edges has odd length with more edges from 
A/ there must be another subpath with more internal edges 
from M' . Swapping the edges of M for those of M' in the 
second subpath results in a matching M" such that |Afj"| > 
\Mii \ contradicting the construction of M to have maximum 
cardinality on each Vi. It follows that |Af| > \M'\, since M is 
a maximum cardinality matching under the constraint that 
it has maximum cardinality inside each Vi. 




Figure 4: An illustration of the last argument in 
Case 2 of the proof of Theorem 15. II with i = 3 and j — 
2. The vertices of Vi are white, the vertices of V2 are 
gray, and the vertices of V3 are black. By switching 
from Af' to M" we increase the utility of agent 2 and 
decrease the utility of agent 3, thereby obtaining a 
legal matching that contradicts the choice of M'. 

We claim that if iA/| > \M'\ then J^^j > Ej IMjI- 

Together with the assumption that \Mli\ = \Mii \ this imphes 
that agent i cannot benefit. Indeed, in this case AfAAf' is 
a path of odd length that starts and ends with an edge of 
M. Recall that every subpath of Ml\M' consisting of i's 
internal edges has even length. This means that when the 
path enters Vi with an edge of M' it cannot end inside Vi , as 
otherwise it would end with an edge of M' . In other words, 
every time the path enters Vi with an edge of M' it must 
exit Vi with an edge of M. Similarly, every time the path 
exits Vi with an edge of M' it must have entered Vi with an 
edge of M, otherwise the path must start in Vi with an edge 
of M'. This proves our claim, so |M| = |M'|. 

Since \M\ = \M'\ we have that MAM' has even length, 
and moreover we know it has even length inside each Vi. 
Note that all the vertices on the path are matched under 
both Ad and A/', except for the start and the end vertices. 
Hence, if agent i gains from the manipulation, it must be 
the case (when fixing a specific direction on the edges) that 
the start vertex is a vertex of Vi and the first edge is an edge 
of M' , whereas the end vertex is in Vj, for some j £ N\ {i}, 
and the last edge is an edge of A4". 

Now, if tie-breaking favors i over j, then by switching the 
edges of M with those of M' we get a matching of equal size 
that has maximum cardinality on each Vi and is better for 
i, in contradiction to the tie-breaking rule. If tie-breaking 
favors j over i, consider the subpath of MAM' that starts 
with the last edge that exits Vi and ends with the last edge 
in MAM'. This path must start with an edge of M' . To 
see why, note that MAM' starts in Vi with an edge of M' . 
This subpath has even length, so it exits with an edge of M' . 
By the same argument as in Case 1, the bipartition ensures 
that, if the path re-enters Vi, it does so with an edge from 
M. Since all subpaths of vertices in Vi are of even length, 
the path always exits Vi with an edge of M' . 

By replacing all the edges of Af' with the edges of M on 
this subpath, we can obtain a matching M" that is identical 
to M' inside Vi, has maximum cardinality on Vk for each 
k £ N, is as large as M' overall, and satisfies Uj(M") = 
Uj(Af') + 1, Ui{M') = Ui{M") - 1, and Uk{M") = Ufe(Af') 
for all k € N\{i, j}. By removing the edges of M (recall this 
is the second stage internal matching of i) from both M' and 
M" we get a contradiction to the way the mechanism broke 
ties when constructing M' (specifically, when constructing 
MATCHn(G')). See Figure|4]for an illustration. □ 

We next show that Matchu can be executed in polyno- 
mial time by a reduction to the maximum weighted matching 
problem (for a polynomial time algorithm see [lUj). 

Theorem 5.2. Matchu can be executed in polynomial 
time. 



Proof. Assume without loss of generality that \E\ > 1, 
and let = 1/\E\^^'^ . We assign weights to edges as follows. 
An (internal) edge (u, v) such that u,v &Vi for some i £ N 
receives weight \E\ + 3. An (external) edge {u,v) such that 
u £ Vi and V £ Vj with i £ Hi and j £ II2 receives weight 
l + ei + ej/\E\"^^ . An (external) edge [u, v) such that u £ Vi 
and V £ Vj with i j but i, j £ Hi or i, j £ H2 receives 
weight 0. 

The sum of the weights of all external edges is at most 
\E\{l + l/\Ef + 1/\E\"+^) < [£;|-h3, whichisless than the 
weight of a single internal edge. Thus a maximum weight 
matching of this graph maximizes the number of internal 
edges. All edges between sets on the same side of the bipar- 
tition have weight zero, so no such edges will be included. 

To complete the proof we need to verify that the max- 
imum weight matching has maximum cardinality among 
those with a maximum number of internal edges and no 
edges across the bipartition, and that ties are broken ap- 
propriately. Each edge across the bipartition has weight at 
least 1 and at most 1 -I- l/\E\' + 1/\E\"+^. Thus, given two 
matchings M and M' satisfying the above constraints such 
that \M\ > \M'\, the difference in their weights is at least 

1 - |M'|(1/|S|' + l/|Sr+^) > 1 - \E\{l/\Ef + 1/\E\"+'') 

= 1 - 1/\E\ - 1/\E\"+^ > 0. 

The maximum weight matching thus has maximum cardi- 
nality subject to the constraints. For tie-breaking, observe 
that ei > \E\ej if i < j , meaning that among agents on the 
same side of the bipartition those with smaller indices have 
higher priority. The factor of finally ensures that 

agents in IIi have priority over agents in 112. D 

Recall that by Theorem 14.11 no deterministic SP mecha- 
nism can have an approximation ratio smaller than 2, even 
when there are only two agents. We will see momentarily 
that Matchh provides an approximation ratio of 2 when 
iV = {1,2} and n = ({1},{2}), i.e., it is the best possi- 
ble deterministic SP mechanism for the case of two agents. 
Indeed, consider a graph G, let A/* be an optimal match- 
ing of G, and M the matching returned by MatcH({i} {2}) • 
M is inclusion- maximal. Therefore, for every {u,v) £ M* , 
either u is matched by A/ or u is matched by M. We con- 
clude that \M\ > \M*\/2. Strategyproofness is obtained 
from Theorem 15.11 

Corollary 5.3. Let N = {1,2}. Then, MatcH({i}.{2}) 
is SP and provides a 2-approximation with respect to social 
welfare. 

Unfortunately, when n > 3, Matcho does not provide a 
finite approximation ratio for any fixed bipartition. To see 
this, let n = (111,112) be a bipartition of the set of agents. 
Then there must be two distinct agents i,j £ N such that 
i,j £ Hi for some I £ {1,2}. Now consider a graph where 
the only edge is an external edge between Vi and Vj; given 
this graph Matcho returns an empty matching, whereas 
the optimum is a matching of cardinality 1. 

We believe that in general deterministic SP mechanisms 
can only provide a bad approximation ratio, even for the 
case of three agents. The following conjecture makes this 
precise. 

Conjecture 5.4. // there are more than two agents, 
no deterministic SP mechanism can provide an a- 



approximation with respect to social welfare for any con- 
stant a. 



6. RANDOMIZED MECHANISMS 

We have seen above that Matcho does not provide a 
bounded approximation ratio for any fixed bipartition 11. 
The natural next step is to choose the bipartition uniformly 
at random. This leads to the eponymous Mix-and-Match 
mechanism. 

Mix-and-Match 

1. Mix: Construct a random bipartition 11 — (111,112) 
of the agents by independently flipping a fair coin for 
each agent to determine whether the agent is in IIi or 
in 112. 

2. Match: Apply MATCHn to the given graph, where 11 
is the bipartition constructed in step 1. 

It immediately follows from Theorem 15.11 that Mix-AND- 
Match is SP, and in fact in a stronger sense than the one 
defined in Section |3] namely universal strategyproofness. A 
randomized mechanism is called universally SP if agents can- 
not gain by lying regardless of the random choices made by 
the mechanism, i.e., if the mechanism is a distribution over 
SP deterministic mechanisms. 

A naive analysis of Mix- AND- Match would yield a rather 
unimpressive approximation ratio. Indeed, the reason why 
MatcH{{i} {2}) does not provide a better approximation ra- 
tio than two is that it may have to sacrifice two external 
edges for one internal edge. The fact that Mix-AND-Match 
will not be able to match many of the edges in the graph 
because they are not between the two elements of the con- 
structed bipartition would seem to cause the approximation 
ratio to deteriorate further. Fortunately, these two problems 
effectively cancel out: sacrificing two external edges for an 
internal edge is less of a problem when each of those external 
edges is allowed to be part of the matching for only half of 
the bipartitions. Formally, we prove the following result. 

Theorem 6.1. For any number of agents, Mix-AND- 
Match is (universally) SP and provides a 2- approximation 
with respect to social welfare. 

Proof. We prove the theorem by taking a maximum car- 
dinality matching M* and constructing a matching M' that, 
when restricted according to a random bipartition (by re- 
moving edges between agents on the same side of the bipar- 
tition) , has at least half the size of M* in expectation. The 
matching produced by MATCHn then always is at least as 
large as M' restricted according to 11. 

Consider a graph G, and let M* be a maximum cardinality 
matching of G. For each i £ N \et M** be a maximum 
cardinality matching on Vi, and let M** = Uigjv ^i* ■ 

We construct a matching M' by considering the symmetric 
difi'erence M*AM**. As in the proof of Theorem [STTJ it 
consists of a set of paths with alternating edges of M* and 
M** . For each path, if there are more internal edges among 
the edges from M**, we put those edges in M' . Otherwise, 
we put the edges from M* in M' . 

Since M** has maximum cardinality on each Vi and M' 
has the same number of internal edges from each path as 
M** , M' has maximum cardinality on each Vi. Furthermore, 
since M* is a maximum cardinality matching, each path has 



Figure 5: Graph illustrating that Mix-and-Match 
cannot provide an approximation ration smaller 
than two. Vi is shown in white, V2 is shown in gray. 
Mix-and-Match returns the matching {v2,v^). 

either the same number of edges from M* and M** or one 
extra edge from M* . All external edges on the path are 
from M*, so if the edges from M** are taken for M' then 
the number of internal edges gained relative to M* is at least 
the number of external edges lost minus one. In the worst 
case M' has two fewer external edges for each extra internal 
edge relative to M* . Thus M' satisfies 

Y,{\Mi,\ - m\) > i EE(iA-^^i - KD' 

i6JV ieN j>i 

where we sum over j > i so as not to count the same edges 
twice. Rearranging, we get 

ieN ieN i>i 

EiA'^ii + ^EEi^-^i- (3) 

iGJV igiV j>i 

Now let be the matching produced by MATCHn for 
the fixed bipartition II. Since Af" has maximum cardinality 
under the constraints, we have 

>Ei^'^-'-i + E E 

ieN ieTiijeTi2 

Since each pair of agents appears on opposite sides in ex- 
actly half of the bipartitions, the expected size of the match- 
ing produced by Mix-AND-Match is 

e(^-ia^"i)>ei^-i+^eeki 

n ^ ^ ieN ieN j>i 

>Ei^-i + ^EEi^^5i 

ieiv ieN i>i 

>\-\M'\, 

where the second inequality follows from ([3|. □ 

The graph in Figure [5] shows that the analysis of Mix- 
AND-Match is tight even for n = 2. Still one might hope to 
do better, given that Theorem 14.11 only provides a random- 
ized lower bound of 4/3. Consider the following randomized 
mechanism for the case of two agents. 

Flip-and-Match 

1. Given a graph G, flip a fair coin. 

2. If the outcome is heads, return MatcH({i}_{2}) (G). 

3. If the outcome is tails, choose a maximum cardinality 
matching, breaking ties in favor of a matching that 
maximizes the total number of internal edges and then 
arbitrarily. 



With probability 1/2 this mechanism uses Matchj^ij {2}) 
and returns a matching of cardinality at least half the opti- 
mum. With probability 1/2 the mechanism returns a maxi- 
mum cardinality matching. Hence, the expected cardinality 
of the matching returned by the mechanism is at least 3/4 
of the cardinality of an optimal one. We conclude that 
Flip-AND-Match provides an approximation ratio of 4/3. 
Whether it is SP however remains an open question. 

Conjecture 6.2. Flip-and-Match is SP (in expecta- 
tion). 

We justify and discuss this conjecture in Appendix [X] 
Note that Flip-and-Match is similar to Mechanism 1 of 
Procaccia and Tennenholtz [TS], in the sense that it selects 
an optimal solution with probability 1/2 and an SP solution 
with probability 1/2. 

Discussion 

Our results have shown that Mix-AND-Match is near opti- 
mal. Theorem 16 . 1 1 shows that it is a 2-approximation, which 
according to Theorem 14. II is the lower bound for determin- 
istic mechanisms and near the lower bound for randomized 
mechanisms. However, a 2-approximation is a 50% efficiency 
reduction and may not be acceptable in practice for kid- 
ney exchanges. The bipartition that Mix-AND-Match uses 
is also somewhat problematic: it may be hard to convince 
hospitals that they best serve their patients by refusing to 
match them with patients from half the other hospitals. Our 
results provide several insights into these issues. 

Our results deal with worst case guarantees. If these are 
essential, then our lower bounds show that nothing better 
can be done so strategyproofness will have to be relaxed. 
An alternative is to consider less strict notions of incentive 
compatibility. This is the route taken in [4]. 

While the worst case performance of Mix-AND-Match 
might be problematic, the average case performance may 
be significantly better. In particular, much of the efficiency 
loss comes from being unable to match patients of hospitals 
assigned to same side of the bipartition. However, in a large 
market with many hospitals and many potential matches for 
each patient this may not be a significant restriction. Our 
guess based on related work is that the loss probably would 
be quite small (on the order of a few percent). However, 
like many average-case questions, the results are sensitive to 
what is chosen as the underlying distribution. This is an 
interesting direction for future research. 

Alternatively, an algorithm like the naive 3-agent algo- 
rithm might be "close enough to strategy-proof" in practice. 
If examples like that of Figure [5] are rare, then there might 
be few enough opportunities for manipulation that the re- 
sults will be tolerable and the use of the bipartition could 
be eliminated. Note however that such an algorithm in still 
only 2-approximate in the worst case. 

Another direction would be to try and characterize the 
space of strategyproof mechanisms, although our results sug- 
gest that there probably is not a simple characterization. 
The MATCHn framework does capture a number of obvious 
strategyproof mechanisms (for example, only taking inter- 
nal edges corresponds to a bipartition with all agents on the 
same side). However, a mechanism like selecting 2 agents 
and then running the 2 agent mechanism on those agents 
does not correspond to any bipartition. If our conjecture 



that Flip-and-Match is strategyproof is correct, that is an- 
other mechanism that does not fit in this framework. While 
all of these examples are "MATCHn like", we also know of at 
least one (relatively complex) mechanism that looks quite 
different. 
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APPENDIX 

A. A DISCUSSION OF FLIP-AND-MATCH 

In order to gain some intuition, let us apply Flip-and- 
Match to the example graph in Figure 1(a) For this graph, 
MatcH({i} {2}) returns the matching 

{{V2,V3), {V4,V5), {V6,V7)}, 

which is also the unique maximum cardinality matching that 
maximizes the number of internal edges. Hence, the utility 
of agent 1 is 3. When agent 1 hides V5 and ve (Figure 1(b) 



MatcH({i} {2}) returns the matching {(«2,'f3)}, whereas the 
unique maximum cardinality matching is {{vi, V2), {vs, V4)}. 
The expected utility of agent 1, also taking into account its 
internal matching on (115, we), is 3. 

While in both cases agent I's expected utility is 3, this 
happens in different ways. If agent 1 does not deviate his 
utility is 3 regardless of which algorithm is used. However, 
if he does deviate he gains when the maximum cardinality 



Figure 6: Graph illustrating that Lemma lA. II cannot 
be generalized to the case of more than two agents. 
As usual, vertices of Vi are shown in white, vertices 
of V2 in gray, and vertices of V3 in black. 

matching is used, but he loses exactly the same amount when 
MatcH({i}_{2}) is used. Thus, randomizing uniformly pre- 
vents an incentive to misreport. This phenomenon occurs in 
all examples we have considered. 

We know from Theorem 15 . 1 1 that an agent can never gain 
under MatcH({i} {2}) by hiding some of its vertices. It might 
however gain under the maximum cardinality matching. In 
order to prove that Flip-AND-Match is SP one would have 
to show that any gain under a maximum cardinality match- 
ing would imply a loss by at least the same amount un- 
der MatcH({i} {2})- However, proving such a claim requires 
considering four different matchings, which causes the tech- 
niques used in the proof of Theorem 15. II to fall short. 

The following observation is however somewhat encour- 
aging. A prion it seems that Flip- AND- Match cannot be 
SP, since on the same graph there may be several maximum 
cardinality matchings that maximize the number of internal 
edges, where some are better for agent 1 and some are bet- 
ter for agent 2. Since ties are broken arbitrarily, by hiding 
some disconnected vertex an agent could in principle cause 
the mechanism to switch between two such matchings. The 
following surprising lemma rules out this potential difficulty. 

Lemma A.l. Let N — {1,2}. Then for any two maxi- 
mum cardinality matchings M and M' such that |Mii| -|- 
IM22I = |Mn| + IM22I tt holds that ui{M) = ui{M') and 

U2{M) ^U2{M'). 

Proof sketch. Let M and M' be two such matchings, 
and assume for contradiction that ui{M) 7^ ui{M'). As in 
the proof of Theorem 15.11 consider the symmetric difference 
MAM' , and assume without loss of generality that it con- 
sists of a single path with alternating edges of M and M' . 
Since |M| = \M'\, the path must be of even length. There- 
fore, since agents 1 and 2 have different utilities, the path 
must have one end in Vi and the other end in V2. This im- 
plies that the number of edges between Vi and V2 on the 
path, that is, the number |Mi2| + \M[2 \ is odd. 

On the other hand. 



|Mli| + |Af22| + |Ml2 



IMI 



|M'| = |Af{iH-|M^2l + |M{2 



and |Mii| + \M22\ = \M[-^\ + IM22I, so we have that |Mi2| = 
IM12I. In particular |Mi2| -I- IM12I is even. We have reached 
a contradiction. □ 

The generalization of this lemma to more than two agents 
turns out to be false. For n = 3, consider the graph in 
Figure H Both 



and 



M = {{vi,V2),{v3,V4),{v5,V(i)} 



M' = {{V2,V3), {V4,,V5), {vfi,V7} 



are maximum cardinality matchings of this graph that max- 
imize the number of internal edges, but ui{M) ^ ui{M') 
and W2(M) ^ W2(M'). 



